本文共 746 字,大约阅读时间需要 2 分钟。
logstash解析系统日志的写法,output中的stdout为调试,生产可以移除
input { redis { host => "192.168.1.181" port => 6379 db => "0" data_type => "list" key => "815" }}filter { grok { match => { "message" => "%{SYSLOGLINE}" } } mutate { remove_field => ["prospector","logsource","beat","[message][0]","offset","@version","input"] } date { match => ["timestamp","MMM dd HH:mm:ss"] } mutate { remove_field => ["timestamp"] }}output { elasticsearch { hosts => ["10.78.1.184:9200","10.78.1.185:9200","10.78.1.188:9200"] index => "message-%{+YYYY.MM.dd}" } stdout { codec => rubydebug }}
转载于:https://blog.51cto.com/liuzhengwei521/2151159